Like I said I've used gpg before however I don't understand how it works to get to the handshake and how to use it effectively for security and privacy. Any help especially literature with both theory and practice on gpg so I can fully implement it.

Can you list some free resources that are detailed, step by step, and cover everything to do with gpg and setting up gpg practically on macos. The main thing I'm having trouble on is ssh, jsonwebtoken, and other auth is used generally for web apps but I've never seen gpg used throughout school and my admitted short so far professional dev experience. Is gpg more about trust between two parties than trust between an organization and a party. What are the gain use cases that ssh won't cover and is gpg more secure in a noticable way?

[Solved]

Hi, I'm trying to import my private gpg key from my old .gnupg folder. I recently reinstalled linux and all I did before was save the .gnupg folder in my /home. Is it possible to import my key in this case?

I tried to copy my old .gnupg to my new linux installation, but when I do :

gpg --list-secret-keys --keyid-format=long

nothing appears.

I'm experimenting with the use of PGP.
I'm using the version of GnuPG packaged with Ubuntu.

I created a keypair and imported them to my keyring.
I then encrypted a message to myself.

When attempting to decrypt I get the message :'gpg: decryption failed: No secret key'

I thought that maybe I mishandled the keypair or made some dumb user error. So I generated another keypair and tried again. The same thing happened.

So I repeated the process of generating and importing keys... and the same thing happened again.

If I do 'gpg -K' I can see that I do in fact have the secret keys for each of the pairs.

But for some reason, gpg simple isn't bothering to try and use them.

What's going on here?

I have been thinking and reading a lot about key management. The main concern, I understand, is malware on your computer obtaining your passphrase and/or key material. So the mitigation is to only ever decrypt your key on an airgapped system, that way at least remote actors can't get it.

However, I have been considering a threat model that includes the possibility of an evil maid attack. For example, I may have roommates, malicious guests, or a highly motivated thief. Depending on how I build the airgapped system, they could figure out how to steal my credentials. The more complex I make my system, the more technically advanced the attacker would have to be to circumvent it. For example:

• I build a system on a Raspberry Pi, unencrypted -> the attacker modifies my SD card to include keylogger
• I encrypt the system -> the attacker takes my SD card, replaces it with a similar, unencrypted one with a fake bootloader to phish me, then steals my credentials after I use it
• I do the above and place a secret on the encrypted SD card so I can verify its integrity -> the attacker just puts the keylogger on the unencrypted bootloader/firmware and leaves the encrypted portion of the card intact
• I do the above, plus run a program on my encrypted storage to verify the integrity of the bootloader and firmware (is this even possible on a Pi?) -> the attacker makes their firmware look untampered to my program
• I do the above, plus encase the whole system in epoxy or something -> at worst, the attacker has to go through the effort to steal my SD card from the casing, then build an identical-looking system to phish me. This would be a massive pain for them, but it would also be a massive pain for me to initially build the system.
• I rebuild the system from scratch (no epoxy) every time I need to sign something -> This is also a pain, and if I consider the possibility that the attacker has tampered with my hardware, then I have to go out and buy a new board each time.

So instead of trying to build something myself, I could use something that's already out there. Yubikeys are popular and have secure, tamper-resistant hardware that I could put my trust in to protect my key from getting leaked. But I'm not comfortable with the fact that someone could just take my Yubikey (e.g., while I'm asleep), go sign some data, and then return it to me. Once I find out that someone has impersonated me, then I pretty much have to revoke my key. If I don't find out someone has impersonated me, then that might be worse. Yeah, I can set a PIN on it, but I have to enter it through the Yubikey app on a computer. Someone with physical access to my Yubikey also has physical access to my laptop (which I am less careful with) and possibly even my home network. So I bet they could phish my PIN. To mitigate this I have to go through all the lengths to build that airgapped tamper-resistant system, which is what I'm trying to avoid in the first place.

OnlyKey requires a PIN, but just looking at the firmware source code, I'm not certain the PIN is actually used to encrypt the sensitive material on the device. If it's not encrypted, then somebody who does computer engineering for fun (I know many) could probably break into it if they had physical access. If it is encrypted, they still could by extracting the memory and brute forcing the PIN (8-10 digits from 1 to 6) on the computer. Not a serious security option IMO, although they are talking on the forums about an upcoming Pro device which will feature encryption. OnlyKey does encrypt secrets at rest. I need to read the security documentation more.

Hardware wallets, though. After reading about the Trezor's security features, I am convinced that it was designed to be resistant both to remote and physical attacks. My understanding is that they store secrets encrypted with a PIN (that can be much longer than 10 digits), so an attacker can't get them if they open the device. The older ones that require you to enter the PIN on your computer do it in a clever way: the device creates a scrambled keypad that it shows to you on its screen, and you click the buttons in corresponding positions on the computer. The scrambling is random and the computer doesn't know which position corresponds to which number, so malware can't take your PIN. The Trezor Safe models even have a secure element, which I understand further protects your secrets from physical tampering, though I'm not sure precisely how. The Trezor devices and some other crypto hardware wallets support a GPG agent. On the trezor, my understanding is that the key will be generated deterministically on the device using its seed, so I suppose there is a disadvantage if your private key (somehow) gets compromised and you have to revoke it, then you will have to use an entirely new seed.

All-in-all, it seems to me like hardware wallets, while initially designed for crypto, would also be the most secure way to generate and store a GPG key, while also providing lots of convenience (I could sign keys on my malware infested personal laptop!). But I don't see them mentioned a lot. Why is this? Am I wrong in my assessment?

When I try to encrypt a message it says error public key unusable no matter who I try to send it to. I can decrypt just fine. It was working fine last month. Any help is greatly appreciated

Hi guys,

i have an excel filles with 500 rows (cell a1 till 500). In each row is an pgp encrypted message. (starts with ---begin pgp message--- & ends with ---end pgp message---.

I can decrypt the message by copying the contect of the cell in notepad section in kleopatra then decrypt the content, and copy the message in cell b1 (to b500).

But how can i speed this up? This will take me ages.

Any solution with VBA or a beginners guide i can find somewhere?

Edit: to clarify, excell file itself is not encryped, alle the messages in each cell are

Edit2: I got it! I used Python (which I knew nothing about just three hours ago), and ChatGPT wrote the code for me with lots of trial and error. The program retrieves encrypted messages from column A, decrypts them using GPG, and stores the decrypted messages in column B, processing cell by cell. The data was originally in a .csv file, and it took me some time to realize that Excel had added an extra line break when converting the data from CSV to XLSX...

Hi all, I am running into a weird situation with gnupg (that may be simply due to my ignorance/misunderstanding): I have an application that is trying to check a key's status (in terms of expiration, having valid signing subkeys, etc). We have no trustdb.gpg created and would like to rely on --import --import-options show only to simply display the key data.

By using --trust-model always and --no-auto-check-trustdb, a simple --import will work as expected (it imports the key), but if I also pass --import-options show only, it seems to fail with a ERROR: gpg: Fatal: can't open '/foo/bar/baz/.gnupg/trustdb.gpg': No such file or directory

Is there any way to avoid touching the trustdb, or alternatively, generating a trustdb.gpg without a keyring to simply show the contents of a key?

Any help is much appreciated!

Computer all of a sudden died on me and I have a text file containing the key but can not for the life of me get it to work on openkeychain android. Really hoping when I get a new pc I will be able to import my secret key using a text file. Any advice appreciated. Stressing because that key was for wallet keys that has half my net worth in it.

If i symmetrically encrypt a file that requires a passphrase to be created to do so, is it actually possible to recover the key and save it to a file? Or is creating a shared secret just saving the passphrase to a file and encrypting it with the receivers public key?

I'm really struggling to decrypt a PGP-encrypted external hard drive from around 2005. I can access the file, and I have the original PGP 8.1 installation file along with my license number. However, the software only runs on Windows XP. I've set up an old computer with XP SP3, and installed PGP 8.1, but I'm hitting a wall with license authorization—it won't connect for online authorization, and manual authorization isn't working either. Although the software recognizes the disk, it requires a licensed version to decrypt it.

I thought about purchasing a newer version of PGP, but it has since been acquired by Broadcom, and I can't find a purchasing option on their less-than-helpful website, additionally, I'm not sure it will work either according to ChatGPT there is a "chance," but no guarantee.

Do you think it’s possible to decrypt this drive using GnuPG or other ideas? While I'm fairly tech-savvy, I'm a n00b when it comes to encryption.

So I have tor running and it opens a socks proxy at localhost:9050. I want to fetch some keys from keys.openpgp.org but I am getting configuration error

The command I run is

gpg --verbose --keyserver-options "http-proxy=socks5://127.0.0.1:9050" --keyserver hkps://keys.openpgp.org --recv-keys EFB9ACCD95CBA34198040A2EE9C4F4EE327CFE76

I get the error

gpg: keyserver receive failed: Configuration error

I dont want to alter my gpg.conf as this is only for this one case.

I am using Linux Mint 21.3 which is based on Ubuntu Jammy and my gpg version is 2.2.27

Solved 💡 Was missing some development libraries, which I added right after installing build-essential

RUN apt-get install zlib1g-dev -y
RUN apt-get install libbz2-dev -y

Hi all

Sorry in advance, I am not extremely linux savvy, but I have been tasked with upgrading our hosting environment from using GnuPG 2.2 to using 2.4.5. The problem however is that the same encrypted files fail on the upgraded system, which uses 2.4.5. The error is:

gpg: uncompressing failed: Unknown compression algorithm

I have tried a lot (I think), like specifying different compression algorithms, installing compression libraries, but to no avail.

The output of --version is:

gpg (GnuPG) 2.4.5
libgcrypt 1.11.0
Copyright (C) 2024 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed

I am wondering if the reason is that it only supports "Uncompressed"? In the old 2.2 it lists multiple compression algorithms:

gpg (GnuPG) 2.2.27
libgcrypt 1.8.8
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

And here is the snippet from my Dockerfile, which installs GnuPG 2.4.5:

# Install required tools
RUN apt-get update
RUN apt-get install bzip2 -y
RUN apt-get install build-essential -y

# Install required libraries
RUN wget https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.50.tar.bz2
RUN tar -xvf libgpg-error-1.50.tar.bz2
RUN cd libgpg-error-1.50 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.11.0.tar.bz2
RUN tar -xvf libgcrypt-1.11.0.tar.bz2
RUN cd libgcrypt-1.11.0 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libassuan/libassuan-3.0.1.tar.bz2
RUN tar -xvf libassuan-3.0.1.tar.bz2
RUN cd libassuan-3.0.1 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libksba/libksba-1.6.7.tar.bz2
RUN tar -xvf libksba-1.6.7.tar.bz2
RUN cd libksba-1.6.7 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/npth/npth-1.7.tar.bz2
RUN tar -xvf npth-1.7.tar.bz2
RUN cd npth-1.7 && ./configure && make && make install

# Install gnupg 2.4.5
RUN wget https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.4.5.tar.bz2
RUN tar -xvf gnupg-2.4.5.tar.bz2
RUN cd gnupg-2.4.5 && ./configure && make && make install

Hi

I was wondering if there was a known standardised method to set the filename of an output file to an encrypted hash?

So for example the command gpg --encrypt --recipient alice@cyb.org --output hashing bank_document.txt would generate a file like hj289dm.txt. Such that the file could only be decrypted and be unhashed by alice's private key?

Thankyou

Introducing our new macOS Mail PGP Extension! Experience top-notch email security with effortless PGP encryption right within your Mail app. Enhance your privacy and keep your communications safe. Download now and secure your inbox!

https://macmailpgp.com

Good day,

We are a set of companies that have lots of senders, via a government dictated hub and then a small receiver set.
The history is that the hub got a company to create a "custom" app to generate the private/public keys, which basically is an antiquated PGP of sorts, if not an early gnupg 1.x

The key pair is generated this way every 4 months, and then the public key shipped to all the senders, and the secret key shared with the receivers - common pub-private key setup.

The "problem" now is that app is a pain to run for me (need to find some x86 Windows VM while I'm on Apple Silicon and Linux servers), and when we did run the GnuPG2 keygen, it came out that GnuPG generated a primary and subkey with split SC & E, while the antiquated custom software does a single key, with SCEA feature to the key.

example differences between the keys:

sec   rsa2048 2024-05-14 [SCEA] [expires: 2024-10-04]
      6AB9B48E00E3F07AEC14C435701D5549DA644AFB
uid           [ unknown] old_key_name


sec   rsa3072 2024-09-18 [SC] [expires: 2025-02-04]
      4EC6C78CB5AEEF773302994ABF85511CDDAE8DD7
uid           [ unknown] gnupg2_key_name
ssb   rsa3072 2024-09-18 [E] [expires: 2025-02-04]

So the problem now is that the public key was distributed to the senders, and they've been using that happily, just... *some* of the receivers now can't decrypt, with the grapevine (via the hub admins) that the keys are `incompatible`

the encrypted files was all decrypted with the 4EC6C78CB5AEEF773302994ABF85511CDDAE8DD7 key from myside.

HELP!!!

Also how to create the key to be only a single key-pair with SCEA settings?

Ok, this might get embarrassing since I just started to use gpg in my workflow.

So I created a primary key with a subkey for signing and a subkey for encryption. Now I wanted to add all my ssh keys to this primary key following https://superuser.com/questions/1414381/how-to-import-an-ssh-ed25519-key-to-gpg.

Is there a way I can mark/tag my new subkeys so I know which one to use for which server?

Or am I completely off what I try to do and misunderstanding how to use gpg subkeys and/or how to use gpg for ssh authentication?

Please be nice to a noob :-D

Now I know it says you shouldn't, as well as gives a warning, but I am wondering if there is a way to do so anyway (knowing the risks).

If anyone can provide any insight or direction, I'd be very grateful. Thank you.

I made my key a while back on a different application and have spent 3 hours trying to import it into cleo but it keeps just saying “imported: 0” and i do not understand why. I have tried EVERYTHING and it simply just will not allow me. I really need to decrypt a message but it wont allow me on any other application for some reason, so the sender told me to try cleo. I cant for the life of me figure out what i could be doing wrong.

I forget it and I don't know how to recover it? Please help

Is there any way to use GPG inside of a text editor WITHOUT installing GPG Suite for Mac?  The reason is that I have a key with curve 448 which is not supported by GPG Suite.

hello,

I'm writing a script that should check if gpg-agent is already unlocked, is there a way to do it?

tried to search a bit with gpg-agent and gpg-connect-agent but maybe I'm looking for the wrong approach.

any help appreciated.

thanks

edit - solved:

gpg-connect-agent "GET_PASSPHRASE --data --no-ask KEY t1 t2 t3" /bye

https://gnupg-users.gnupg.narkive.com/hAQna4v1/is-gpg-agent-passphrase-status-query-possible

Why do these commands:

/usr/bin/gpg --pinentry-mode=loopback --batch --passphrase password --quick-generate-key  rsa4096
/usr/bin/gpg --pinentry-mode=loopback --batch --passphrase password --quick-generate-key  rsa4096
echo "This is a test" > /tmp/tmp692499503
/usr/bin/gpg --pinentry-mode=loopback --passphrase password --output /tmp/tmp692499503.gpg --encrypt --armor --recipient  /tmp/tmp692499503user1@example.comuser2@example.comuser1@example.com

Give me this output:

gpg: key 603EE7D84AF4910A marked as ultimately trusted
gpg: revocation certificate stored as '/home/personal/.gnupg/openpgp-revocs.d/EC757DEBB42A81C3F74DC136603EE7D84AF4910A.rev'
gpg: key 6D4BD9137F7CCC09 marked as ultimately trusted
gpg: revocation certificate stored as '/home/personal/.gnupg/openpgp-revocs.d/C322ABE2D32ED2EB047EDD3F6D4BD9137F7CCC09.rev'
gpg: error retrieving 'user1@example.com' via Local: Unusable public key
gpg: error retrieving 'user1@example.com' via WKD: No data
gpg: user1@example.com: skipped: No data
gpg: /tmp/tmp692499503: encryption failed: No data

Using -expert full-keygen in MacOS terminal, I have created a new keypair with the curve 448.  But it doesn't appear in GPG Keychain.  When I open the key in the text editor and copy its content, GPG Keychain crashes.

Hi I have been trying to work out how to pgp pages to open. I haven't sent an e-mails yet. I've no luck. I have tried everything I can think of I would greatly appreciate any help or suggest a link or something. cheers I appreciate your time.

Anyone having thoughts on how this bifurcation may affect usage and interoperability of gnupg in the future? What about key management?

i tried using --full-gen-key and remove sign, but then it generates a key that only signs

how do i generate only the thing that says "cv25519" and encrypts? why can't i create only that?

So I was having some problems with auto gpg signing in GitHub Desktop recently and today I got this error:

gpg: skipped "<my-secret-key>": No secret key
gpg: signing failed: No secret key
error: gpg failed to sign the data
fatal: failed to write commit object

I got these special attributes in my .gitconfig file:

[filter "lfs"]
    clean = git-lfs clean -- %f
    smudge = git-lfs smudge -- %f
    process = git-lfs filter-process
    required = true


[commit]
    gpgsign = true
[gpg]
    program = C:\\Program Files (x86)\\GnuPG\\bin\\gpg.exe

There's also a link to my original question on StackOverflow: https://stackoverflow.com/q/78948849/17754099

Actually, sometimes it also returns:

gpg: keyblock resource 'C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming\\gnupg\\pubring.kbx': No such file or directory
gpg: skipped "<my-secret-key>": No secret key
gpg: signing failed: No secret key
error: gpg failed to sign the data
fatal: failed to write commit object

when I did literally nothing. This is sometimes fixed with setting the default gpg directory to

C:\\Program Files (x86)\\GnuPG\\bin\\gpg.exe

but most of the time, the .gitconfig stays the same without any changes and still outputs the second error.

Can someone help me with these problems? I'm on Windows 10 and I'm using gpg4win

Does changing the photo ID associated with my GPG key also invalidate all signatures on my key or is the photo ID not validated by them?

have a problem with decryption SECRET _ SUBKEY_0X7700FC6F Ecrypt.asc' contains certificates and can't be decrypted or verified. It worked 4 or 5 times know can't access thanks

Many years ago I created a key for public C++ coding projects. The HDD of that machine died, and the private key is not recoverable. The key still appears in keyserver.ubuntu.com

Is there any way to revoke such key? I don't even remember the passphrase at this point. Last time I used it was about 10 years ago. I still write code, and the email address associated with that key is one I use for newer projects (with a newer key).

Now when I search my name in the public keyring, the same email appears with two public keys, one of which I need to revoke.